ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Issue with EdgeRouter Lite/ Verizon FiOS

    IT Discussion
    6
    24
    5.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JaredBuschJ
      JaredBusch @A Former User
      last edited by

      @thecreativeone91 said:

      @FiyaFly said:

      @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

      configure
      set firewall all-ping enable
      commit
      save

      Is there additional steps needed?

      From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

      http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

      From what I read the code is something like this

      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
      set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

      no single ticks on all of that, but yes that is right..

      Here is the sanitized firewall config on my ERL in our colo space. It has my PBX in a Flash system behind it.

      Last login: Mon Oct 13 12:47:42 2014 from win8jar64
jbusch@erl:~$ show configuration commands firewall
set firewall all-ping enable
set firewall broadcast-ping disable
set firewall group address-group FSL_Addresses address XXX.XXX.XXX.XXX/29
set firewall group address-group FSL_Addresses description 'Forklifts of St Louis IP Information'
set firewall group network-group BundyAddresses description 'Bundy User IP Blocks'
set firewall group network-group BundyAddresses network XXX.XXX.XXX.XXX/16
set firewall group port-group PBXPorts description 'Ports used by the PBX'
set firewall group port-group PBXPorts port 4569
set firewall group port-group PBXPorts port 5060
set firewall group port-group PBXPorts port 10000-20000
set firewall ipv6-receive-redirects disable
set firewall ipv6-src-route disable
set firewall ip-src-route disable
set firewall log-martians enable
set firewall name LAN_IN default-action accept
set firewall name LAN_IN description 'Internal network to Internet'
set firewall name LAN_LOCAL default-action accept
set firewall name LAN_LOCAL description 'Internal network to router'
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'Internet to internal networks'
set firewall name WAN_IN rule 1 action accept
set firewall name WAN_IN rule 1 description 'Accept established and Related'
set firewall name WAN_IN rule 1 log disable
set firewall name WAN_IN rule 1 protocol all
set firewall name WAN_IN rule 1 state established enable
set firewall name WAN_IN rule 1 state related enable
set firewall name WAN_IN rule 2 action drop
set firewall name WAN_IN rule 2 description 'Drop Invlid'
set firewall name WAN_IN rule 2 log enable
set firewall name WAN_IN rule 2 protocol all
set firewall name WAN_IN rule 2 state invalid enable
set firewall name WAN_IN rule 3 action accept
set firewall name WAN_IN rule 3 description 'Accept New for PBX from Bundy Emp'
set firewall name WAN_IN rule 3 destination group port-group PBXPorts
set firewall name WAN_IN rule 3 log enable
set firewall name WAN_IN rule 3 protocol udp
set firewall name WAN_IN rule 3 source group network-group BundyAddresses
set firewall name WAN_IN rule 3 state new enable
set firewall name WAN_IN rule 4 action accept
set firewall name WAN_IN rule 4 description 'Accept New for PBX from FSL'
set firewall name WAN_IN rule 4 destination group port-group PBXPorts
set firewall name WAN_IN rule 4 log enable
set firewall name WAN_IN rule 4 protocol udp
set firewall name WAN_IN rule 4 source group address-group FSL_Addresses
set firewall name WAN_IN rule 4 state established disable
set firewall name WAN_IN rule 4 state invalid disable
set firewall name WAN_IN rule 4 state new enable
set firewall name WAN_IN rule 4 state related disable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'Internet to router'
set firewall name WAN_LOCAL rule 1 action accept
set firewall name WAN_LOCAL rule 1 description 'Accept Established and Related'
set firewall name WAN_LOCAL rule 1 log disable
set firewall name WAN_LOCAL rule 1 protocol all
set firewall name WAN_LOCAL rule 1 state established enable
set firewall name WAN_LOCAL rule 1 state related enable
set firewall name WAN_LOCAL rule 2 action drop
set firewall name WAN_LOCAL rule 2 description 'Drop Invlaid'
set firewall name WAN_LOCAL rule 2 log enable
set firewall name WAN_LOCAL rule 2 protocol all
set firewall name WAN_LOCAL rule 2 state invalid enable
set firewall name WAN_LOCAL rule 5 action accept
set firewall name WAN_LOCAL rule 5 description 'Accept Rate Limited Ping'
set firewall name WAN_LOCAL rule 5 limit burst 1
set firewall name WAN_LOCAL rule 5 limit rate 50/minute
set firewall name WAN_LOCAL rule 5 log enable
set firewall name WAN_LOCAL rule 5 protocol icmp
set firewall receive-redirects disable
set firewall send-redirects enable
set firewall source-validation disable
set firewall syn-cookies enable
jbusch@erl:~$
      1 Reply Last reply Reply Quote 0
      • JaredBuschJ
        JaredBusch @A Former User
        last edited by

        @thecreativeone91 said:

        set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'

        Also, just FYI, when using my MBP it can ping too fast and this rate limiter will show time outs. I set this to 62/minute and the timeouts went away.

        1 Reply Last reply Reply Quote 0
        • ?
          A Former User @FiyaFly
          last edited by A Former User

          @FiyaFly said:

          @NetworkNerd said:

          @FiyaFly said:

          @NetworkNerd said:

          @FiyaFly said:

          @thecreativeone91 said:

          @FiyaFly said:

          @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

          configure
          set firewall all-ping enable
          commit
          save

          Is there additional steps needed?

          From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

          http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

          From what I read the code is something like this

          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
          set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

          Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

          Any other ideas for that part, then?

          Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

          Yes it does. I have also ensured that ports are open and forwarded to the PBX.

          If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

          Sadly, FortiVoice, so unable to get in via CLI

          So the PBX is internal not hosted. It's just the SIP Trunk that is having issues?

          scottalanmillerS 1 Reply Last reply Reply Quote 0
          • scottalanmillerS
            scottalanmiller @A Former User
            last edited by

            @thecreativeone91 said:

            @FiyaFly said:

            @NetworkNerd said:

            @FiyaFly said:

            @NetworkNerd said:

            @FiyaFly said:

            @thecreativeone91 said:

            @FiyaFly said:

            @thecreativeone91 We ran a set of commands to ensure that the router would respond to pings:

            configure
            set firewall all-ping enable
            commit
            save

            Is there additional steps needed?

            From what I read that only enables the OS to respond it doesn't open of the firewall ACL.

            http://community.ubnt.com/t5/EdgeMAX/bug-in-firewall-all-ping-option/td-p/735073

            From what I read the code is something like this

            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'action' 'accept'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'description' 'ICMP 50/m'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'burst' '1'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'limit' 'rate' '50/minute'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'log' 'enable'
            set 'firewall' 'name' 'WAN_LOCAL' 'rule' '5' 'protocol' 'icmp'

            Okay, I see. You're right. Adding a rule to that set in the UI and we are now seeing pings to the Edge Router. However, we are still having issues getting inbound calls to our PBX (They time out) and cannot register a softphone internally onto a hosted system (backup plan)

            Any other ideas for that part, then?

            Does the SIP trunk show registered when you look at the PBX despite the behavior you mention here?

            Yes it does. I have also ensured that ports are open and forwarded to the PBX.

            If this is Asterisk (which I am guessing it may be), what happens in the CLI for inbound calls?

            Sadly, FortiVoice, so unable to get in via CLI

            So the PBX is internal not hosted. It's just the SIP Trunk that is having issues?

            Yes and yes.

            1 Reply Last reply Reply Quote 0
            • ?
              A Former User
              last edited by

              well to find out if it is a SIP trunk provider issue or not you could setup another extension on NTGs PBX then use that as the SIP Trunk peer on theirs for testing. If that works you know it's an issue with the trunk provider.

              1 Reply Last reply Reply Quote 1
              • JaredBuschJ
                JaredBusch
                last edited by

                Or if the provider with the problem is not VoIP.ms you can always make a sub account on any VoIP.ms account and set that up as a trunk too.

                NetworkNerdN 1 Reply Last reply Reply Quote 1
                • NetworkNerdN
                  NetworkNerd @JaredBusch
                  last edited by

                  @JaredBusch said:

                  Or if the provider with the problem is not VoIP.ms you can always make a sub account on any VoIP.ms account and set that up as a trunk too.

                  I like the idea of getting a test trunk as well.

                  1 Reply Last reply Reply Quote 0
                  • NetworkNerdN
                    NetworkNerd
                    last edited by

                    You could do the free trial of OnSIP: http://www.onsip.com/pricing. I know it is really hosted VOIP, but it should at least allow testing of SIP and RTP traffic passing through the router. It takes the PBX out of the equation completely though.

                    1 Reply Last reply Reply Quote 1
                    • scottalanmillerS
                      scottalanmiller
                      last edited by

                      SIP and RTP are working. Outbound calls work, inbound do not.

                      1 Reply Last reply Reply Quote 0
                      • NetworkNerdN
                        NetworkNerd
                        last edited by

                        So what was the resolution on this one? I'm sure others would like to know if it was the SIP provider, the Ubiquiti device, or something else entirely.

                        1 Reply Last reply Reply Quote 0
                        • 1
                        • 2
                        • 2 / 2
                        • First post
                          Last post